remove session auth, and use my custom "terrible" token auth